Overview 

Our primary objective is to achieve optimal visibility into our client's environment. The incorporation of FortiGate with the Cognna platform enhances our ability to obtain a thorough perspective on your infrastructure's security. This integration empowers us to efficiently analyze and triage events related to firewall.

To achieve this integration, we will follow the following steps:

1. Head to the FortiGate firewall interface, once we have logged in, go to the “Log & Report” section, and then select “log setting” In this section, we will proceed to configure the events that we want to send the collector server that we requested earlier.

1. Within the “Log setting” section, we will specify which specific events we need to send to the collector. In this case, we will choose to enable all events.

1. Now, to set up syslog, we first enable the “Syslog logging” option. Here, you should enter the IP address of the collector
   
2. Change the default portNormally, the default port for syslog is 514, but in this case, we are going to use a different port: 9012. If this port used previously, you can use different port and share it with usCustomizing the port is an excellent practice, especially when managing multiple integrations with Syslog. By using different ports, you can avoid conflicts and streamline log management. This enables greater control and organization of your log data, which is essential for effective monitoring.

To do this, you will need to use the command line, as the graphical interface does not display the option to configure the port.

Kindly ignore the values in the figure and use your Logcollector IP and port 9013

To check your configuration, you must see the specified values  

1. The last step is to ensure that the firewall policy is not denying the connection to the collector server. You can achieve this by creating a policy that ensures communication to the server.
   

Frequently Asked Questions (FAQ) and Troubleshooting

Frequently Asked Questions

Q1. What details must be gathered prior to commencing setup?

Before proceeding with the configuration of your firewall, ensure you have gathered the following parameters:

• The IP address belonging to the collector server (you should prepare log collector machine at your end ).
• Designated Syslog port (typically 9012) as indicated by Cognna.
• The designated transport layer protocol: UDP or TCP, as arranged with us.
• Confirmation that traffic flow from the firewall to the destination host is permitted.
• Identification of necessary log types and event classifications for security oversight.

Core Integration Requirements

• Agentless Architecture: Leverages standard native Syslog transmission directly from the security appliance; no additional software deployment is needed.
• Connection Parameters: Requires the Collector IP, destination Syslog Port (default: 9012), and Transport Protocol (UDP/TCP) shared by Cognna.
• Logging Scope: Enable selected event types within the Log & Report settings. Enabling full logging maximizes environmental visibility.
• Network Routing: Confirm that network access controls, static routing, and local-out rules allow traffic to reach the collector server.

Verification & Diagnostic CLI Commands

• Step 1 (Firewall Egress): To confirm outbound packet generation from the unit, execute:

diagnose sniffer packet any 'host <COLLECTOR_IP> and port <PORT>' 4 0 l

• Step 2 (Server Ingress): From the Linux collector host, verify incoming traffic arrival:

sudo tcpdump -ni any 'host <FIREWALL_IP> and port <PORT>'

• Step 3 (Platform Parsing): Ensure the target service is listening, local firewalls permit the port, and reach out to Cognna to confirm log processing.

Troubleshooting Quick-Check Matrix